tcpdump stateful filtering
Consider I have two hosts A and B. They both have a webserver on port 80. Both servers download files from each other through their webservers. A:some_port <--> b:80 and at the same time A:80 <--> B:some_port.
How can I run a tcpdump to capture all packets whose client is either host A, or B? I do not want to have a mixed up dump file including packets from both connections.
if I use开发者_如何学C:
tcpdump -i eth0 host A and port 80
I receive all packets between A and B. And if I change it to
tcpdump -i eth0 src host A and src port 80
then I just received wrong half the packets.
Do you have any suggestions?
I couldn't find any way to do that. Yet, what I did was to use different source port ranges for different connections and use them in my tcpdump filter...
tcpdump -i eth0 -nn portrange $dumpPortListenRange1
tcpdump -i eth0 -nn portrange $dumpPortListenRange2
I know it is not the answer, but it is tweak to make it work...
精彩评论